Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
54949
Total
4343
Critical
16375
High
16061
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-66077 | UNKNOWN | — | RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which <%= ... … | Sep 23, 2026 |
| CVE-2026-66075 | UNKNOWN | — | RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, is_authorized/2 for the /federation-links/.../restart route uses is_authorized_monitor (accepts the … | Sep 23, 2026 |
| CVE-2026-66074 | UNKNOWN | — | RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, match_value/3 passes the user-supplied ?name= regular expression to re:run … | Sep 23, 2026 |
| CVE-2026-66072 | UNKNOWN | — | RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, get_chunk_selector/1 calls binary_to_atom on the raw client-supplied <<"chunk_selector">> property … | Sep 23, 2026 |
| CVE-2026-66069 | UNKNOWN | — | RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, is_authorized/2 uses is_authorized_monitor for all methods. DELETE resets rabbit_core_metrics:reset_auth_attempt_metrics(). Impact is … | Sep 23, 2026 |
| CVE-2026-66068 | UNKNOWN | — | RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, ?LOG_DEBUG("shutting down Shovel '~ts', ... Shovel state: ~tp", [Name, … | Sep 23, 2026 |
| CVE-2026-66067 | UNKNOWN | — | RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The stream open handler calls only check_vhost_access; it omits the node/vhost/user connection-limit … | Sep 23, 2026 |
| CVE-2026-53979 | UNKNOWN | — | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | Sep 23, 2026 |
| CVE-2026-53978 | UNKNOWN | — | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | Sep 23, 2026 |
| CVE-2026-53969 | UNKNOWN | — | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | Sep 23, 2026 |
| CVE-2026-53968 | UNKNOWN | — | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | Sep 23, 2026 |
| CVE-2026-96889 | HIGH | 7.8 | A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. … | Sep 23, 2026 |
| CVE-2026-96826 | HIGH | 7.6 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shazzad Hossain Khan W4 Post List allows Blind SQL Injection. This … | Sep 23, 2026 |
| CVE-2026-96552 | LOW | 3.1 | A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The affected element is the function MD5.getMD5 of the file ssm_pro/src/main/java/cn/sfturing/utils/MD5.java of the component User … | Sep 23, 2026 |
| CVE-2026-96551 | MEDIUM | 4.3 | A vulnerability was determined in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Impacted is an unknown function of the file ssm_pro/src/main/java/cn/sfturing/web/CommonUserController.java. Executing a manipulation can lead to … | Sep 23, 2026 |
| CVE-2026-96550 | LOW | 3.7 | A vulnerability was found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This issue affects the function getProperties of the file ssm_pro/src/main/java/cn/sfturing/utils/MailUtil.java. Performing a manipulation results in … | Sep 23, 2026 |
| CVE-2026-94183 | HIGH | 7.4 | Arc Search for Android before version 1.12.10 does not display a fullscreen notification when a page enters fullscreen mode while the app is running in … | Sep 23, 2026 |
| CVE-2026-87900 | UNKNOWN | — | Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts. | Sep 23, 2026 |
| CVE-2026-87899 | UNKNOWN | — | Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges. | Sep 23, 2026 |
| CVE-2026-87898 | UNKNOWN | — | OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges. | Sep 23, 2026 |
| CVE-2026-86065 | HIGH | 7.5 | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /subscribe endpoint in network/api/websocket/routes.go accepts unauthenticated WebSocket clients with … | Sep 23, 2026 |
| CVE-2026-86064 | HIGH | 8.6 | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured in config/node/api.yaml and registered by … | Sep 23, 2026 |
| CVE-2026-85475 | HIGH | 7.2 | A flaw was found in the Ansible Automation Platform automation controller. The external logging (rsyslog) configuration is generated by interpolating user-controlled settings — LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH … | Sep 23, 2026 |
| CVE-2026-84724 | MEDIUM | 6.6 | An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without running … | Sep 23, 2026 |
| CVE-2026-84721 | MEDIUM | 6.4 | A server-side request forgery flaw was found in the Ansible Automation Platform automation-controller email notification backend. The email backend passes the user-supplied SMTP host and … | Sep 23, 2026 |